Exercise
Identify CUI Examples
Practice separating CUI from FCI and from ordinary business information.
Advanced
15 min
Free
NIST SP 800-171
CMMC
Published · v1.0.0 · 2026-08-01
Checklist
Government Contractor Startup Checklist
What to put in place before your first federal award creates security obligations you cannot meet.
- Intended audience
- Businesses entering federal or defense contracting
- Difficulty
- Intermediate
- Estimated time
- 40 minutes
- Access
- Free
FAR
DFARS
NIST SP 800-171
CMMC
Government contracting
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Read security and flow-down clauses in a solicitation before bidding, not after award.
- Determine whether prospective work involves FCI, CUI, or neither before committing resources.
- Stand up basic safeguarding controls and a system boundary ahead of contract performance.
- Establish incident reporting responsibilities and a self-assessment schedule before work begins.
Get ahead of the clause
Security clauses are not negotiable after award. Reading them before you bid is the cheapest compliance work you will ever do.
Key takeaways
- Security clauses are not negotiable after award, so reading them before bidding is the cheapest compliance work available.
- Determining whether work involves FCI or CUI early shapes which safeguarding requirements apply.
- Subcontractor agreements must pass required security clauses down the supply chain.
- A System Security Plan and POA&M should exist before performance starts, not be created reactively.
Checklist
Progress0 of 12 (0%)
Progress is saved in this browser only. It is not a compliance record.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
Acquisition.gov
FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems(opens in a new tab)Link last confirmed 2026-02-01
Acquisition.gov
DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting(opens in a new tab)Link last confirmed 2026-02-01
U.S. Government Publishing Office
32 CFR Part 170 — Cybersecurity Maturity Model Certification Program(opens in a new tab)Link last confirmed 2026-02-01
National Archives (ISOO)
Controlled Unclassified Information (CUI) Registry(opens in a new tab)Link last confirmed 2026-02-01
Earn a Certificate of Training Completion
Complete every section, acknowledge, and pass the knowledge check.
Sections opened0 of 1
This certificate recognizes completion of educational training material only. It is not a professional certification, accreditation, license, compliance assessment, audit result, or attestation of compliance with any law, regulation, or contract requirement. ComplianceAnvil is not a certification authority, accreditation body, assessor, or law firm.
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal)
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This resource is educational readiness material. ComplianceAnvil is not a certification authority, assessor, or law firm, and this content is not legal advice or a compliance assessment.
Related resources
Matched on shared frameworks, topics, and program packs.
Guide
Understanding Controlled Unclassified Information (CUI)
How to recognize CUI, why marking matters, and what changes the moment you handle it.
Intermediate
12 min
Free
NIST SP 800-171
DFARS
Published · v1.0.0 · 2026-08-01
Guide
Understanding Federal Contract Requirements
How security obligations actually reach you: clauses, flow-downs, and the questions to ask before you sign.
Intermediate
13 min
Free
FAR
DFARS
Published · v1.0.0 · 2026-08-01
Checklist
CMMC Readiness Checklist
Work through the preparation steps most small contractors miss before a CMMC assessment: scope, system boundary, documentation, and evidence.
Intermediate
45 min
Free
CMMC
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Guide
What is NIST SP 800-171?
The requirement set that governs protecting Controlled Unclassified Information in non-federal systems, explained without the jargon.
Intermediate
14 min
Free
NIST SP 800-171
CMMC
Published · v1.0.0 · 2026-08-01
Checklist
NIST SP 800-171 Preparation Checklist
A plain-language preparation pass across the requirement families, focused on what a small business must produce and prove.
Advanced
60 min
Free
NIST SP 800-171
CMMC
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.